fix: deep-clone postMessage payloads to avoid DataCloneError with framework proxies

[behnam-oneschema]

Summary

Customer reported that upgrading @oneschema/vue from 0.6.x to 0.7.2 broke their production — Vue reactive Proxy objects in launch params (e.g. templateOverrides, customizationOverrides) cause a DataCloneError when postMessage attempts structured cloning on the iframe message.

This applies a JSON.parse(JSON.stringify(...)) deep-clone to the postMessage payload in both the Importer and FileFeeds #iframeEventEmit methods. This strips non-structurally-cloneable wrappers (like Vue's Proxy) before posting to the iframe.

The fix is in the core packages rather than the Vue wrapper so it is framework-agnostic and defensive against similar issues from other reactive frameworks.

Review & Testing Checklist for Human

• Verify no message fields rely on undefined vs absent-key semantics — JSON.stringify omits object keys with undefined values (whereas structured clone preserves them as undefined). Check that the embed app's postMessage handler does not distinguish between a missing key and an explicit undefined.
• Test with a Vue 3 app passing reactive templateOverrides/customizationOverrides to importer.launch() — confirm the DataCloneError no longer occurs and the import session initializes correctly.
• Spot-check that non-Vue integrations (React, vanilla JS) still work — the JSON round-trip should be transparent for plain objects, but worth a quick sanity check.

Notes

• The FileFeeds fix is proactive; the customer only reported the issue against the Importer, but the same postMessage pattern exists in FileFeeds.
• JSON.parse(JSON.stringify(...)) will also drop any Date, RegExp, or function values — these types don't appear in the current payload interfaces, but worth being aware of if the message shape evolves.
• There are currently no automated tests in this repo for either package, so this change is untested beyond lint.

Link to Devin session: https://app.devin.ai/sessions/71ec3b816ec04b519a0dd348218fd107
Requested by: @behnam-oneschema

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.